Skip to content

Commit

Permalink
cifs: If a corrupted DACL is returned by the server, bail out.
Browse files Browse the repository at this point in the history
Static code analysis reported a possible null pointer dereference
in my last commit:
cifs: Retain old ACEs when converting between mode bits and ACL.

This could happen if the DACL returned by the server is corrupted.
We were trying to continue by assuming that the file has empty DACL.
We should bail out with an error instead.

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Reported-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Rohith Surabattula <rohiths@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
  • Loading branch information
Shyam Prasad N authored and Steve French committed Feb 24, 2021
1 parent f1a0865 commit f1ebe48
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions fs/cifs/cifsacl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1275,8 +1275,8 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
if (dacloffset) {
dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) {
cifs_dbg(VFS, "Existing ACL size is wrong. Discarding old ACL\n");
dacl_ptr = NULL;
cifs_dbg(VFS, "Server returned illegal ACL size\n");
return -EINVAL;
}
}

Expand Down

0 comments on commit f1ebe48

Please sign in to comment.